Coverage Report

Created: 2025-06-22 06:51

/src/nestegg/test/fuzz.cc
Line
Count
Source (jump to first uncovered line)
1
/*
2
 * Copyright © 2018 Mozilla Foundation
3
 *
4
 * This program is made available under an ISC-style license.  See the
5
 * accompanying file LICENSE for details.
6
 */
7
#include <assert.h>
8
#include <stdarg.h>
9
#include <stdio.h>
10
#include <stdlib.h>
11
#include <stdint.h>
12
#include <string.h>
13
#include "nestegg/nestegg.h"
14
15
/* fuzz.cc is meant to be used with LibFuzzer
16
 * (https://llvm.org/docs/LibFuzzer.html)
17
 *
18
 * To build:
19
 * clang -g -O1 -fsanitize=fuzzer -I./include src/nestegg.c test/fuzz.cc -o fuzz
20
 *
21
 * NOTE: At the moment there are large chunks of code that have been copied
22
 *       from regress.c
23
 */
24
25
/* Three functions that implement the nestegg_io interface, operating on a
26
   io_buffer. */
27
struct io_buffer {
28
  unsigned char const * buffer;
29
  size_t length;
30
  int64_t offset;
31
};
32
33
static int
34
ne_buffer_read(void * buffer, size_t length, void * userdata)
35
2.64M
{
36
2.64M
  struct io_buffer * iob = reinterpret_cast<struct io_buffer *>(userdata);
37
2.64M
  size_t available = iob->length - iob->offset;
38
39
2.64M
  if (available == 0)
40
5.04k
    return 0;
41
42
2.64M
  if (available < length)
43
186
    return -1;
44
45
2.64M
  memcpy(buffer, iob->buffer + iob->offset, length);
46
2.64M
  iob->offset += length;
47
48
2.64M
  return 1;
49
2.64M
}
50
51
static int
52
ne_buffer_seek(int64_t offset, int whence, void * userdata)
53
0
{
54
0
  struct io_buffer * iob = reinterpret_cast<struct io_buffer *>(userdata);
55
0
  int64_t o = iob->offset;
56
57
0
  switch(whence) {
58
0
  case NESTEGG_SEEK_SET:
59
0
    o = offset;
60
0
    break;
61
0
  case NESTEGG_SEEK_CUR:
62
0
    o += offset;
63
0
    break;
64
0
  case NESTEGG_SEEK_END:
65
0
    o = iob->length + offset;
66
0
    break;
67
0
  }
68
69
0
  if (o < 0 || o > (int64_t) iob->length)
70
0
    return -1;
71
72
0
  iob->offset = o;
73
0
  return 0;
74
0
}
75
76
static int64_t
77
ne_buffer_tell(void * userdata)
78
77.2k
{
79
77.2k
  struct io_buffer * iob = reinterpret_cast<struct io_buffer *>(userdata);
80
77.2k
  return iob->offset;
81
77.2k
}
82
83
84
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
85
6.64k
{
86
6.64k
  int r, type, id, track_encoding, pkt_keyframe, pkt_encryption, cues;
87
6.64k
  int64_t read_limit = -1;
88
6.64k
  nestegg * ctx;
89
6.64k
  nestegg_audio_params aparams;
90
6.64k
  nestegg_packet * pkt;
91
6.64k
  nestegg_video_params vparams;
92
6.64k
  size_t length;
93
6.64k
  uint64_t duration = ~0, pkt_tstamp, pkt_duration, tstamp_scale, default_duration;
94
6.64k
  int64_t pkt_discard_padding, pkt_reference_block;
95
6.64k
  unsigned char * codec_data, * ptr, * pkt_additional;
96
6.64k
  unsigned char const * track_content_enc_key_id, * pkt_encryption_iv;
97
6.64k
  unsigned int i, j, tracks = 0, pkt_cnt, pkt_track;
98
6.64k
  unsigned int data_items = 0;
99
6.64k
  uint8_t pkt_num_offsets;
100
6.64k
  uint32_t const * pkt_partition_offsets;
101
102
6.64k
  nestegg_io io;
103
6.64k
  struct io_buffer userdata;
104
6.64k
  userdata.buffer = data;
105
6.64k
  userdata.length = size;
106
6.64k
  userdata.offset = 0;
107
108
6.64k
  io.read = ne_buffer_read;
109
6.64k
  io.seek = ne_buffer_seek;
110
6.64k
  io.tell = ne_buffer_tell;
111
6.64k
  io.userdata = &userdata;
112
113
6.64k
  ctx = NULL;
114
6.64k
  r = nestegg_init(&ctx, io, NULL, read_limit);
115
6.64k
  if (r != 0)
116
1.28k
    return 0;
117
118
5.36k
  nestegg_track_count(ctx, &tracks);
119
5.36k
  nestegg_duration(ctx, &duration);
120
5.36k
  nestegg_tstamp_scale(ctx, &tstamp_scale);
121
5.36k
  cues = nestegg_has_cues(ctx);
122
123
108k
  for (i = 0; i < tracks; ++i) {
124
103k
    type = nestegg_track_type(ctx, i);
125
103k
    id = nestegg_track_codec_id(ctx, i);
126
103k
    nestegg_track_codec_data_count(ctx, i, &data_items);
127
103k
    track_encoding = nestegg_track_encoding(ctx, i);
128
103k
    r = nestegg_track_default_duration(ctx, i, &default_duration);
129
103k
    if (track_encoding == NESTEGG_ENCODING_ENCRYPTION) {
130
1.72k
      nestegg_track_content_enc_key_id(ctx, i, &track_content_enc_key_id, &length);
131
1.72k
    }
132
138k
    for (j = 0; j < data_items; ++j) {
133
35.2k
      nestegg_track_codec_data(ctx, i, j, &codec_data, &length);
134
35.2k
    }
135
103k
    switch (type) {
136
21.0k
    case NESTEGG_TRACK_VIDEO:
137
21.0k
      nestegg_track_video_params(ctx, i, &vparams);
138
21.0k
      break;
139
1.71k
    case NESTEGG_TRACK_AUDIO:
140
1.71k
      nestegg_track_audio_params(ctx, i, &aparams);
141
1.71k
      break;
142
    //case NESTEGG_TRACK_UNKNOWN:
143
    //  break;
144
80.3k
    default:
145
80.3k
      break;
146
103k
    }
147
103k
  }
148
149
12.4k
  for (;;) {
150
12.4k
    pkt = NULL;
151
12.4k
    r = nestegg_read_packet(ctx, &pkt);
152
12.4k
    if (r <= 0) {
153
5.36k
      assert(pkt == NULL);
154
5.36k
      break;
155
5.36k
    }
156
7.09k
    nestegg_packet_track(pkt, &pkt_track);
157
7.09k
    pkt_keyframe = nestegg_packet_has_keyframe(pkt);
158
7.09k
    nestegg_packet_count(pkt, &pkt_cnt);
159
7.09k
    nestegg_packet_tstamp(pkt, &pkt_tstamp);
160
7.09k
    pkt_duration = 0;
161
7.09k
    nestegg_packet_duration(pkt, &pkt_duration);
162
7.09k
    pkt_discard_padding = 0;
163
7.09k
    nestegg_packet_discard_padding(pkt, &pkt_discard_padding);
164
7.09k
    pkt_reference_block = 0;
165
7.09k
    nestegg_packet_reference_block(pkt, &pkt_reference_block);
166
7.09k
    pkt_additional = NULL;
167
7.09k
    nestegg_packet_additional_data(pkt, 1, &pkt_additional, &length);
168
7.09k
    pkt_encryption = nestegg_packet_encryption(pkt);
169
7.09k
    if (pkt_encryption == NESTEGG_PACKET_HAS_SIGNAL_BYTE_ENCRYPTED ||
170
7.09k
        pkt_encryption == NESTEGG_PACKET_HAS_SIGNAL_BYTE_PARTITIONED) {
171
767
      nestegg_packet_iv(pkt, &pkt_encryption_iv, &length);
172
767
    }
173
7.09k
    if (pkt_encryption == NESTEGG_PACKET_HAS_SIGNAL_BYTE_PARTITIONED) {
174
515
      nestegg_packet_offsets(pkt, &pkt_partition_offsets, &pkt_num_offsets);
175
515
    }
176
47.9k
    for (i = 0; i < pkt_cnt; ++i) {
177
40.8k
      nestegg_packet_data(pkt, i, &ptr, &length);
178
40.8k
    }
179
7.09k
    nestegg_free_packet(pkt);
180
7.09k
  }
181
182
5.36k
  nestegg_destroy(ctx);
183
5.36k
  return 0;
184
5.36k
}